Libtv Api Skills

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:46 AM UTC
• Version: 1.0.0

Overview

The skill’s creative-media purpose is clear, but installation depends on an unpinned global npm package and account-token CLI behavior that were not included for review.

Review this before installing. Prefer a pinned version or isolated environment, avoid running npm with elevated privileges, confirm the npm package and GitHub source are the intended publisher, and be aware that login tokens and uploaded images/videos may be handled by the external libtv CLI and LibLib.tv service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-25
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

markdown

## 🛠️ 安装依赖

```bash
npm install -g @libtv/skills

text

### Technical Analysis

The installation instructions retrieve the latest available version of `@libtv/skills` from the configured npm registry and install it globally without specifying an audited version or integrity value. Because npm package versions are mutable from the consumer's perspective when no version is pinned, the code installed by future users may differ from the code originally reviewed.

npm installation may execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. A compromised package release, publisher account, registry response, or dependency could therefore execute arbitrary code during installation. Global installation also places the package's executable entry points in a shared command location, increasing the consequences of package compromise.

The repository contains only `SKILL.md`; the source code and package metadata for `@libtv/skills` are not included. Consequently, the package's lifecycle scripts, transitive dependencies, authentication handling, upload behavior, and CLI execution paths could not be audited.

### Attack Path

1. An attacker compromises the npm publisher account, the package itself, a transitive dependency, or the package distribution channel.
2. The attacker publishes a malicious release of `@libtv/skills` or causes a malicious dependency to be resolved.
3. A user follows the documented command without selecting a known, reviewed version.
4. npm resolves and downloads the attacker-controlled release.
5. Malicious lifecycle scripts execute during installation, or malicious code executes when the user later invokes the globally installed `libtv` command.
6. The payload operates with the privileges and environment 
...[truncated 874 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an explicitly reviewed version, for example:

   bash

   npm install --global @libtv/skills@<reviewed-version>
   

2. Publish and verify package provenance, including the official npm scope, publisher identity, source repository, release signatures, and build provenance.
3. Provide integrity hashes or a signed release-verification procedure for distributed artifacts.
4. Audit package lifecycle scripts and transitive dependencies before recommending installation.
5. Prefer a project-local installation or an isolated execution environment over global installation where feasible.
6. Advise users not to run the installation command with administrative privileges.
7. Use lockfiles and automated dependency scanning in the package's source repository to constrain and continuously assess transitive dependencies.
8. Include the actual package source or a verifiable reference to the exact audited revision so reviewers can inspect credential handling, file access, network behavior, and command execution.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger examples include very broad natural-language phrases such as '画一个 xxx' and '来段 xxx', which overlap with ordinary user speech and can cause the skill to activate unintentionally. In an agent environment, this increases the risk of prompt-triggered execution paths that invoke external image/video generation actions without the user clearly intending to use this specific skill.

Content

No source excerpt is available for this finding.